4 ms·

Malaysia backtracks on DNS redirection decision

86 points by yen223 2y ago

Shank 2y ago
A rare move showing grace on behalf of the government, but the fact that the decision was made first, followed subsequently by a backtrack is still alarming.
- usrnm 2y ago
  It costs very little to try and see if it works out, they will try again shortly. You can see the same bahavior with chat regulatons in the EU.
  - carstenhag 2y ago
    Same as with preemptive governmental data storage, which gets warmed up about every year in Germany...
- nucleative 2y ago
  I'm an American working from Thailand for the past decade or so, and this strategy is relatively common for the governments around here. It's chaotic. They will usually have mid level officials announce some new policy as if it's a done deal. Then, if there's no public outcry, a higher level official will confirm it and maybe, eventually, details will roll out. If the public responds very negatively, the idea will just disappear or the higher level guy can distance himself from the low level guy "who was misinformed". I think it's how they test the water and decide if it's worth the effort.
aussieguy1234 2y ago
While they've backtracked, every dictator in the world probably took notice and its only a matter of time.
- MonkeyClub 2y ago
  Greece is already way ahead! When one tries to visit some sites like LibGen, DNS is redirected to a "no-no you shouldn't go there" page, which in turn redirects to this official finger-wagging page: https://opi.gr/edppi_block/edppi_block.html https://opi.gr/edppi_block/edppi_block.html DNS hijacking was also used during the beginning of the Ukraine affair as part of an EU-wide censorship push, blocking sites like the Kremlin and Pravda, though without further redirection.
  - skrause 2y ago
    We're talking about two different issues though: 1. Blocking or redirecting some pages when using the ISP's DNS server. This is what you're talking about. The workaround is to use a third party DNS resolver. 2. Intercepting all unencrypted DNS traffic to any DNS server and redirecting it to the ISPs' DNS servers. This is what Malaysia was planning to do.
    - nubinetwork 2y ago
      It sounds to me like Malaysia wanted to do both...
      - skrause 2y ago
        Malaysia is already doing the first one.
  - mytailorisrich 2y ago
    Not a very good example as LibGen is blocked by court decisions in a number of countries because of copyright infringement issues. It's even been ordered to close by a US court (according to Wikipedia). Obviously they ignored that as they are not in the US...
  - sunaookami 2y ago
    As is Germany with the "CUII" where every relevant ISP DNS-blocks "copyright-violating" sites without a court decision. And of course EU-wide where f.e. RT is blocked (not vetoed by a court or parliament).
kome 2y ago
Can DNS-over-HTTPS help to avoid this?
- deleted 2y ago
  [deleted]
- tedk-42 2y ago
  Yes, assuming you have a non compromised browser or certificate trust chain
  - commandersaki 2y ago
    Tangential question: how are IP addresses in certificates validated? Cloudflare was subject to a BGP hijack of the 1.1.1/24 prefix, how does it prevent someone from running a malicious DNS server?
    - dist-epoch 2y ago
      But wouldn't the malicious DNS server need the private key of that certificate?
    - galliher 2y ago
      It’s still imperfect AFAIK. Your provider may or may not have upstream routers speaking BGP and running RPKI validation at ASN boundaries which validate prefixes against certificates blessed by the appropriate RIRs (maybe analogous to CAs for routes). Since you mentioned Cloudflare I’ll just cut to the chase and link an instance of their blog on the subject : https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ First example of imperfection which springs to mind first for me are misconfigurations in the network which ultimately allow for leaks to be accepted. IMHO this compounded with the nature of DNS recursion across name authorities on the far side of any ASN boundaries (that may be out of your provider’s control) makes any assurances weak at best when searching for name resolution trust. (Edit : oh and I think DNSSEC is probably another layer worth considering. But it’s also inconsistently deployed.) (Second edit : Sorry! I made a mental leap to RPKI when I saw “BGP hijack”, “certificate”, & “IP addresses”. IIRC a webserver’s x509 certificates don’t contain an OID of any inaddr{,6}, nor cidr type. i.e. a browser doesn’t verify a httpd’s ip against anything in the cert vended. Only that the cert is signed by a chain leading to a CA trusted by the client/browser(s).)
consumerx 2y ago
LOL
slurpyb 2y ago
The advertisements on this website gives me a panic attack
defrost 2y ago
While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project. https://dnsprivacy.org/ https://dnsprivacy.org/ stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers. Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend either stubby or it's docs to let people know how to use it access | establish a much broader DNS proxy network to allow for indirect non obvious lookups.
- netsharc 2y ago
  Off-topic: Why are you using | instead of / ? People having their unique implementation of punctuation marks irks me...
  - oarsinsync 2y ago
    At a guess, because regex and/or coding generally. In a number of regex implementations and programming languages, | is used as an inclusive OR
  - deleted 2y ago
    [deleted]
  - defrost 2y ago
    Because I've used it as an "or" symbol in a non unique common as muck manner since 1980 at least when I was taught Boolean logic in an undergraduate university mathematics class. It's one of many conventional symbols for OR, more common in the pure ASCII days due to a lack of ∧ , ∨ , ¬ et al. Which rock have you lived under that you've never seen it used an OR before? People imposing their limited experience of the wide world upon others would certainly irk some, but rest easy, I've not taken offence at your odd assumption of non existent universal convention.
    - mkl 2y ago
      To be fair, I've never seen it used in prose like that, and had trouble understanding your comment at first. I did university boolean logic 30 years ago and have been on the internet in programming communities nearly as long.
Euphorbium 2y ago
Can they selectively do it to just the ones that matter to them, and be undetectable this way?
nubinetwork 2y ago
Past discussion https://news.ycombinator.com/item?id=41471510 https://news.ycombinator.com/item?id=41471510
csomar 2y ago
> He stressed that cybercrime issues, including access to gambling, prostitution and pornography websites, are extremely concerning and demand comprehensive solutions They are not exactly backtracking but it seems that some of the involved parties didn't like the solution proposed (DNS redirection) and want to discuss other alternatives.
deleted 2y ago
[deleted]
jusepal 2y ago
I'm currently in Malaysia. TM, the biggest public facing ISP here goes a step further by also ssl mitm-ing Google dns and Cloudflare dns DoH endpoint. Their idea is to hijack and route all query intended for both to their own DoH server. Obviously browsers showed big red warning about the attack since users explicitly setup their browser to use Google or Cloudflare DoH but instead being hijacked and routed to TM's own DoH endpoint. The whole ordeal is so baffling, i wonder which senior network admin at TM give that a go, or whether TM actually got competent network admin at all. With that single misstep, suddenly the people realized if they could (and did) mitm Google and Cloudflare dns endpoint, they could mitm Gmail, Outlook, Riotgames, Facebook, Tiktok or whatever too. Public outcry comes pouring in and the Minister of Comm backtracked.

86 points by yen223 2y ago

A rare move showing grace on behalf of the government, but the fact that the decision was made first, followed subsequently by a backtrack is still alarming.

usrnm 2y ago
It costs very little to try and see if it works out, they will try again shortly. You can see the same bahavior with chat regulatons in the EU.
- carstenhag 2y ago
  Same as with preemptive governmental data storage, which gets warmed up about every year in Germany...
nucleative 2y ago
I'm an American working from Thailand for the past decade or so, and this strategy is relatively common for the governments around here. It's chaotic. They will usually have mid level officials announce some new policy as if it's a done deal. Then, if there's no public outcry, a higher level official will confirm it and maybe, eventually, details will roll out. If the public responds very negatively, the idea will just disappear or the higher level guy can distance himself from the low level guy "who was misinformed". I think it's how they test the water and decide if it's worth the effort.

aussieguy1234 2y ago

While they've backtracked, every dictator in the world probably took notice and its only a matter of time.

MonkeyClub 2y ago
Greece is already way ahead! When one tries to visit some sites like LibGen, DNS is redirected to a "no-no you shouldn't go there" page, which in turn redirects to this official finger-wagging page: https://opi.gr/edppi_block/edppi_block.html https://opi.gr/edppi_block/edppi_block.html DNS hijacking was also used during the beginning of the Ukraine affair as part of an EU-wide censorship push, blocking sites like the Kremlin and Pravda, though without further redirection.
- skrause 2y ago
  We're talking about two different issues though: 1. Blocking or redirecting some pages when using the ISP's DNS server. This is what you're talking about. The workaround is to use a third party DNS resolver. 2. Intercepting all unencrypted DNS traffic to any DNS server and redirecting it to the ISPs' DNS servers. This is what Malaysia was planning to do.
  - nubinetwork 2y ago
    It sounds to me like Malaysia wanted to do both...
    - skrause 2y ago
      Malaysia is already doing the first one.
- mytailorisrich 2y ago
  Not a very good example as LibGen is blocked by court decisions in a number of countries because of copyright infringement issues. It's even been ordered to close by a US court (according to Wikipedia). Obviously they ignored that as they are not in the US...
- sunaookami 2y ago
  As is Germany with the "CUII" where every relevant ISP DNS-blocks "copyright-violating" sites without a court decision. And of course EU-wide where f.e. RT is blocked (not vetoed by a court or parliament).

kome 2y ago

Can DNS-over-HTTPS help to avoid this?

deleted 2y ago
[deleted]
tedk-42 2y ago
Yes, assuming you have a non compromised browser or certificate trust chain
- commandersaki 2y ago
  Tangential question: how are IP addresses in certificates validated? Cloudflare was subject to a BGP hijack of the 1.1.1/24 prefix, how does it prevent someone from running a malicious DNS server?
  - dist-epoch 2y ago
    But wouldn't the malicious DNS server need the private key of that certificate?
  - galliher 2y ago
    It’s still imperfect AFAIK. Your provider may or may not have upstream routers speaking BGP and running RPKI validation at ASN boundaries which validate prefixes against certificates blessed by the appropriate RIRs (maybe analogous to CAs for routes). Since you mentioned Cloudflare I’ll just cut to the chase and link an instance of their blog on the subject : https://blog.cloudflare.com/rpki/ https://blog.cloudflare.com/rpki/ First example of imperfection which springs to mind first for me are misconfigurations in the network which ultimately allow for leaks to be accepted. IMHO this compounded with the nature of DNS recursion across name authorities on the far side of any ASN boundaries (that may be out of your provider’s control) makes any assurances weak at best when searching for name resolution trust. (Edit : oh and I think DNSSEC is probably another layer worth considering. But it’s also inconsistently deployed.) (Second edit : Sorry! I made a mental leap to RPKI when I saw “BGP hijack”, “certificate”, & “IP addresses”. IIRC a webserver’s x509 certificates don’t contain an OID of any inaddr{,6}, nor cidr type. i.e. a browser doesn’t verify a httpd’s ip against anything in the cert vended. Only that the cert is signed by a chain leading to a CA trusted by the client/browser(s).)

consumerx 2y ago

LOL

slurpyb 2y ago

The advertisements on this website gives me a panic attack

defrost 2y ago

While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project. https://dnsprivacy.org/ https://dnsprivacy.org/ stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers. Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend either stubby or it's docs to let people know how to use it access | establish a much broader DNS proxy network to allow for indirect non obvious lookups.

netsharc 2y ago
Off-topic: Why are you using | instead of / ? People having their unique implementation of punctuation marks irks me...
- oarsinsync 2y ago
  At a guess, because regex and/or coding generally. In a number of regex implementations and programming languages, | is used as an inclusive OR
- deleted 2y ago
  [deleted]
- defrost 2y ago
  Because I've used it as an "or" symbol in a non unique common as muck manner since 1980 at least when I was taught Boolean logic in an undergraduate university mathematics class. It's one of many conventional symbols for OR, more common in the pure ASCII days due to a lack of ∧ , ∨ , ¬ et al. Which rock have you lived under that you've never seen it used an OR before? People imposing their limited experience of the wide world upon others would certainly irk some, but rest easy, I've not taken offence at your odd assumption of non existent universal convention.
  - mkl 2y ago
    To be fair, I've never seen it used in prose like that, and had trouble understanding your comment at first. I did university boolean logic 30 years ago and have been on the internet in programming communities nearly as long.

Euphorbium 2y ago

Can they selectively do it to just the ones that matter to them, and be undetectable this way?

nubinetwork 2y ago

Past discussion https://news.ycombinator.com/item?id=41471510 https://news.ycombinator.com/item?id=41471510

csomar 2y ago

> He stressed that cybercrime issues, including access to gambling, prostitution and pornography websites, are extremely concerning and demand comprehensive solutions They are not exactly backtracking but it seems that some of the involved parties didn't like the solution proposed (DNS redirection) and want to discuss other alternatives.

deleted 2y ago

[deleted]

jusepal 2y ago

I'm currently in Malaysia. TM, the biggest public facing ISP here goes a step further by also ssl mitm-ing Google dns and Cloudflare dns DoH endpoint. Their idea is to hijack and route all query intended for both to their own DoH server. Obviously browsers showed big red warning about the attack since users explicitly setup their browser to use Google or Cloudflare DoH but instead being hijacked and routed to TM's own DoH endpoint. The whole ordeal is so baffling, i wonder which senior network admin at TM give that a go, or whether TM actually got competent network admin at all. With that single misstep, suddenly the people realized if they could (and did) mitm Google and Cloudflare dns endpoint, they could mitm Gmail, Outlook, Riotgames, Facebook, Tiktok or whatever too. Public outcry comes pouring in and the Minister of Comm backtracked.